Security Audit Report: Reentrancy & Access Control Review: Rocket Pool

In the security audit report for the Rocket Pool protocol, researchers identified several critical issues related to reentrancy and access control in the core contracts. The protocol's primary contracts handle node-operator registration, staking pool accounting, reward distribution, governance, and admin functions. Given the substantial assets under management ($1 B) and the protocol's interconnectivity with other DeFi primitives, the security of its reentrancy and access-control mechanisms is of utmost importance.

The audit focused on the latest main-net deployment (v1.3.0) and the corresponding L2 adapters for Ethereum and L2 networks. The analysis covered twelve thousand lines of core staking code, nine thousand lines of reward and withdrawal logic, and three thousand lines of L2 bridge implementation.

The report highlights three critical reentrancy vulnerabilities:

1. In RocketMinipool's withdraw function, no nonReentrant modifier is applied, allowing an attacker-controlled contract to extract ETH multiple times by receiving the funds in the fallback function, potentially leading to the complete loss of the minipool balance.

2. RocketDepositPool's deposit function forwards ETH to RocketNodeManager without updating totalDeposits before the external call. This oversight enables a malicious RocketNodeManager implementation to manipulate the deposit count, causing inaccurate Total Value Locked (TVL) reporting and reward allocation.

3. RocketL2Bridge's finalizeWithdrawal function transfers ERC20 tokens without a reentrancy guard, making it susceptible to an attacker-controlled malicious token triggering multiple transfers for the same L2 withdrawal.

Regarding access control weaknesses, seven critical issues were identified:

1. RocketDAOProtocolSettings' setProtocolDao function lacks an owner check, enabling any address to alter the DAO address and potentially redirect control to a malicious contract.

2. RocketDAOProposal's execute function does not verify the target address, allowing arbitrary contract calls with any data, which could lead to arbitrary code execution or fund theft.

3. RocketNodeManager's addNodeOperator function only checks if msg.sender equals protocolDao, leaving the contract open to takeover by a compromised DAO executor.

4. RocketMinipoolQueue has no access restrictions, making it susceptible to DoS attacks and spamming the protocol with malicious minipool contracts.

5. RocketL2Bridge's setBridgeOperator function is callable by the owner only, but in the constructor, the owner is set to msg.sender, lacking a timelocked governance contract for enhanced security.

6. RocketTokenRETH's mint function grants the minting role to RocketDAOProtocolSettings, which is upgradeable via an unprotected upgradeTo function. This allows an attacker to inflate the rETH supply and dilute token holders.

7. RocketDAOProtocolSettingsNetwork's setNetworkParameters function has no access restrictions, leaving the network parameters vulnerable to manipulation by an attacker.

The overall risk score for the protocol is 7.4 out of 10, classified as "High". The most severe issues stem from missing non-reentrant guards and over-privileged admin functions that can be exploited by compromised DAO executors. The audit provides detailed remediation steps for each identified vulnerability, aiming to enhance the security and reliability of the Rocket Pool protocol.